Loading story…
A credential phishing campaign used fake "New Audio MSG" emails to lure recipients to a Play Audio link that passed through multiple tracking and redirect stages before landing on a Google-themed sign-in page. Researchers said the operation carried a Base64-encoded copy of the target’s email address through the chain to personalize the final page, which impersonated Google Accounts, Google Workspace, or Google Voice. The phishing flow abused trusted-looking infrastructure and cloud services, including Framer-hosted pages and Cloudflare Workers, to make the delivery path appear legitimate and harder to block.
The final phishing stages used HTML smuggling techniques aligned with MITRE ATT&CK T1027.006, including JavaScript Blob objects and inline content reconstruction, to hide or dynamically generate malicious content in the victim’s browser. LevelBlue also observed related multi-stage campaigns using custom CAPTCHA, anti-debugging logic, Web Crypto API decryption, and newly registered domains, with one chain ending in OneDrive device-code phishing. Researchers warned that layered redirects and inline browser-side payload generation can evade static blocklists and recommended preserving full redirect chains, correlating email clicks with login attempts, and blocking malicious destinations across email, web, and DNS controls.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the hunting analytic "Splunk HTTP Response Splitting Via Rest SPL Command" from its content library in version 5.6.0, stating the associated CVEs had been patched in the latest Splunk release. The removed analytic had been intended to detect attempts to exploit an HTTP response splitting vulnerability via REST SPL commands.
LevelBlue also identified a second phishing campaign that used newly registered domains in a staged redirect chain ending in a OneDrive-themed device code phishing page. The final page included anti-debugging measures, and LevelBlue said all URLs in the chain were less than one year old and were classified as phishing only by LevelBlue at the time of analysis.
LevelBlue identified a phishing campaign that used Framer-hosted lure pages and a Cloudflare Workers redirect to deliver a Google Account phishing page. The final stage used custom CAPTCHA, anti-debugging logic, Web Crypto API decryption, and HTML redirection smuggling via the Blob API.
Researchers reported a credential phishing campaign using fake "New Audio MSG" emails that route victims through tracking and redirect infrastructure before landing on Google-themed credential-harvesting pages. The campaign carried a Base64-encoded copy of the recipient's email address through the redirect chain and used a Blob URL in the final phishing stage.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
levelblue.com
Open sourcecybersecuritynews.com
Open sourceresearch.splunk.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals have launched a sophisticated phishing campaign that exploits Google Cloud's Application Integration service to send emails that closely mimic legitimate Google notifications. By leveraging the service's "Send Email" task, attackers are able to distribute messages from the trusted `noreply-application-integration@google.com` address, effectively bypassing traditional email security measures such as DMARC and SPF. The phishing emails are crafted to resemble routine enterprise communications, including voicemail alerts and file access requests, increasing the likelihood that recipients will trust and interact with them. Over a two-week period, nearly 9,400 phishing emails targeted approximately 3,200 organizations across the U.S., Asia-Pacific, Europe, Canada, and Latin America. The attack chain employs a multi-stage redirection process to evade detection and maximize credential theft. Initial links in the emails direct users to legitimate Google Cloud URLs (`storage.cloud.google.com`), followed by a redirection to `googleusercontent.com` where a fake CAPTCHA is presented to bypass automated scanners. The final stage leads victims to a counterfeit Microsoft login page hosted on a non-Microsoft domain, designed to harvest user credentials. This campaign demonstrates the increasing abuse of trusted cloud infrastructure for phishing, highlighting the need for organizations to scrutinize even seemingly authentic emails originating from reputable domains.
Jun 29, 2026
Multiple active phishing operations are leveraging *trusted services* and *by-design web/authentication features* to bypass security controls and harvest credentials and MFA data. **GTFire** is a large-scale credential-harvesting campaign that hides behind legitimate Google-owned domains by abusing **Firebase** and **Google Translate** to make phishing links appear trustworthy to email filters and web gateways; victims are sent to brand-impersonation login pages and then redirected to the real site after submitting credentials. Separately, Microsoft reported phishing that abuses **OAuth redirection** behavior in identity providers (including **Microsoft Entra ID** and **Google Workspace**) by registering malicious OAuth apps with attacker-controlled redirect URIs and using silent auth flows/invalid scopes to bounce users to attacker infrastructure; Microsoft disabled the identified malicious Entra OAuth applications but noted related activity continues and requires monitoring. A distinct but thematically similar campaign uses a fake Google Account security site to trick users into installing a **malicious Progressive Web App (PWA)** that can steal one-time passcodes (via **WebOTP** where supported), harvest data (e.g., clipboard contents), and even turn the victim’s browser into an attacker-controlled **proxy** with internal port-scanning capability; Malwarebytes-linked reporting highlighted the lure domain `google-prism[.]com` and the use of permission prompts (notifications/clipboard) to enable ongoing abuse. Other items in the set cover unrelated threats (Android malware using generative AI for persistence, an Iraq-focused APT toolchain, a separate AiTM phishing-kit attribution case study, and research on a cybercrime infrastructure provider), and do not describe the same specific phishing operations described above.
Jun 29, 2026
Threat actors are increasingly using **trusted platforms**—including cloud hosting and major ad networks—to deliver multi-stage phishing and scam campaigns that evade traditional URL and domain reputation controls. Recent activity includes a **three-step malvertising chain** delivered via **Facebook paid ads** that redirects victims through a decoy site (e.g., a fake Italian restaurant page) before landing on a **tech support scam (TSS) kit** hosted on **Microsoft Azure** infrastructure (including `web.core.windows.net`). Researchers reported rapid infrastructure churn, with **100+ domains rotated in seven days**, and targeting focused on **U.S. users** with activity concentrated on weekdays. Parallel enterprise-focused campaigns are hosting phishing infrastructure on **Microsoft Azure Blob Storage**, **Google Firebase**, and **AWS CloudFront**, using **redirect chains, CAPTCHA gates, and QR codes** to bypass automated analysis and email defenses. Analysis highlighted the use of **Adversary-in-the-Middle (AiTM)** phishing-as-a-service kits—**Tycoon2FA**, **Sneaky2FA**, and **EvilProxy**—to steal credentials and **session tokens** even when MFA is enabled. Separately, researchers documented a “clean email” approach to steal **Dropbox** credentials: benign-looking procurement-themed emails deliver **PDF attachments** that hide clickable elements (e.g., via *AcroForms* and `FlateDecode`), which then route victims to a second-stage file hosted on **Vercel Blob** and ultimately to a fake Dropbox login page that captures credentials and collects victim telemetry (IP address, location, and device details).
Jun 29, 2026